Semiconductor integrated circuit, authentication system, and authentication method

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is based upon and claims the benefit of priority from the prior Japanese Patent Application No. 2014-008088 filed on Jan. 20, 2014, with the Japanese Patent Office, the entire contents of which are incorporated herein by reference.

FIELD

The disclosures herein relate to a semiconductor integrated circuit, an authentication system, and an authentication method.

BACKGROUND

In recent years, some products such as printer cartridges, batteries and game-machine cartridges have been provided with an authentication function to prevent clone products (i.e., counterfeit products) from being introduced. An authentication function may be implemented by use of confidential information (e.g., private key) that guarantees the genuineness of products. However, confidential information stored in the nonvolatile memory embedded in an IC chip may be at the risk of being stolen by a malignant user. Analysis of the internal structure of an IC chip embedded inside a genuine product by use of a microscope for performing minute inspection may successfully identify the values of confidential information stored in the nonvolatile memory.

A PUF (physically unclonable function) is an effective tool for implementing an authentication function in a secure manner without storing confidential information in a nonvolatile memory. Confidential information generated by a PUF cannot be identified even when analysis utilizing a microscope or the like is performed.

A PUF circuit is provided with a physically unclonable function, and generates a product-specific output value (hereinafter referred to as “product-specific information). Some PUFs generate a specific output without taking an input, and other PUFs serve as a function that receives an input and generates an output responsive to the input. An ideal PUF circuit has the following characteristics. As a first characteristic, a PUF implemented in a given device invariably outputs the same produce-specific information (reproducibility). In the case of a PUF receiving an input, the PUF invariably output the same product-specific information in response to the same input. As a second characteristic, PUFs implemented in different devices output completely different product-specific information (uniqueness). In the case of PUFs receiving an input, the PUFs in different devices output different product-specific information in response to the same input.

In general, a PUF is configured such that the output thereof is determined in response to minute differences in the signal delay and device characteristics of a device attributable to variation between devices. This arrangement makes it possible to implement a PUF output that assumes a value that completely varies from device to device. In the case of such a PUF, a PUF implemented in a given device may produce an output value that varies depending on the operating voltage, operating temperature, or the like. That is, the reproducibility of a PUF output is not 100%. Some measures for error correction may thus be employed.

PUFs as described above may be utilized to implement an encryption function, thereby improving product security. One example is a smartcard. Further, confidentiality of communication is guaranteed by utilizing encryption functions in terminals for wireless Internet connection and in the SIM cards of portable phones. To this end, PUFs may be used in the part that generates an encryption key. Such an arrangement significantly reduces the risk of an encryption key being successfully analyzed by a malignant user, thereby improving security.

An authentication system that uses a PUF with an input and an authentication system that uses a PUF without an input have respective, different configurations and characteristics, and have respective advantages and disadvantages.

A PUF that generates a 1-bit output in response to an n-bit input will be described in the following as an example of a PUF with an input. In the case of such a PUF, there are 2ⁿdifferent combinations of an input and an output. With this PUF, an authentication system will have the configuration as follows. A table is generated that lists 2ⁿpairs of an input and an output in respect of a PUF implemented in a given device (i.e., genuine chip), and is stored in advance in an authentication server. In order to check whether a device in question is a genuine product, the authentication server applies an input to the device in question, and checks whether the output value returned in response to the input is in agreement with the output value listed in the table stored in the server, thereby performing authentication. The input that is applied to a device in question is referred to as a “challenge”, and the output of the device in question is referred to as a “response”.

In the case of this procedure, the large size of the table stored in the server for authentication may give rise to a problem. A given product may be subjected to authentication 10000 times during the life cycle of this product. In such a case, a minimum of 10000 pairs of a challenge and a response need to be in existence in the server. Since the values listed in the table differ from PUF to PUF (i.e., differ for each chip in question), tables as many as the number of sold chips need to be stored in the authentication server. As a result, the total size of tables stored in the authentication server becomes enormous, resulting in an increase in the time required for authentication. Further, the reproducibility of a PUF may not be 100%. In such a case, the server may be provided in advance with a mechanism for correcting an error, which results in an cost increase.

In the case of using a PUF without an input, there is supposed to be only one invariable output pattern. In consideration of this, a system that enables the provision of an authentication system by combining an encryption function with the output of a PUF serving as a key may be used. To be more specific, a plurality of output bits generated by a PUF embedded in a given device are stored in a register within the device. The data stored in the register is to be used as a key input into an encryption function. An authentication server has the key and the encryption function registered therein. In order to check whether a device in question is a genuine product, the authentication server supplies a plaintext input serving as a challenge to the encryption function of the device in question, which then produces an encrypted text as a response. This response is matched against the output that is internally generated in the authentication server by using the key and the encryption function in the authentication server, thereby performing authentication. In the case of reproducibility being not 100%, the output of the PUF may contain error. Error correction code or the like may be used to correct the data, which is then registered in the register.

The use of the above-noted configuration does not require a large size table in an authentication server, thereby offering a high degree of convenience. Such an authentication system, however, may have a low level of anti-counterfeiting security. One possible attack point may be the correction data that is used to correct error in the output of the PUF. The correction data is supposed to be stored in a nonvolatile memory. A malignant user may thus be able to read the correction data by reverse engineering. As a result, there is a risk of the key being compromised based on the correction data. Another possible attack point may be the register that stores the key. A malignant user may use a side-channel attack or the like to identify the key stored in the register. When this happens, the security of the authentication system is totally compromised.

Among the related-art configurations as described above, the authentication system that uses table data and a PUF with an input requires a large amount of data to be stored in the authentication server, which poses a problem in practical application. The authentication system that uses an encryption function and a key provided by a PUF without an input has a low level of security against an attack. It may be noted that the objective is to prevent a counterfeit product from being manufactured. Ultimately, therefore, achieving this objective is what is desired regardless of the presence or absence of an authentication system. Accordingly, it may be desirable to provide a semiconductor integrated circuit that utilizes a PUF to effectively and efficiently prevent a counterfeit product from being manufactured.

[Patent Document 1] Japanese National Publication of International Patent Application No. 2005-523481

[Patent Document 2] Japanese National Publication of International Patent Application No. 2007-509563

[Patent Document 3] Japanese National Publication of International Patent Application No. 2008-514975

SUMMARY

According to an aspect of the embodiment, a semiconductor integrated circuit includes a first circuit configured to provide a predetermined function and a second circuit configured to have a physically unclonable function, wherein the second circuit is incorporated into the first circuit such that a signal value of at least one node in the first circuit varies in response to an output of the second circuit, and the output of the second circuit is set such that the first circuit provides the predetermined function.

According to an aspect of the embodiment, an authentication system includes a server having a transformation function stored therein to transform first data to second data, and a semiconductor integrated circuit configured to communicate with the server, wherein the semiconductor integrated circuit includes a first circuit configured to realize the transformation function, and a second circuit configured to have a physically unclonable function, wherein the second circuit is incorporated into the first circuit such that a signal value of at least one node in the first circuit varies in response to an output of the second circuit, and the output of the second circuit is set such that the first circuit provides the transformation function.

According to an aspect of the embodiment, a method for authentication includes supplying an input into a circuit that has a physically unclonable function incorporated therein and that realizes a predetermined transformation function, receiving a first output generated by the circuit in response to the input, supplying the input to the transformation function provided separately from the circuit to cause the transformation function to produce a second output, and comparing the first output with the second output.

The object and advantages of the embodiment will be realized and attained by means of the elements and combinations particularly pointed out in the claims. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the invention, as claimed.

BRIEF DESCRIPTION OF DRAWINGS

<figref idref="DRAWINGS">FIGS. 1A and 1B</figref> are drawings illustrating an example of the configuration of a semiconductor integrated circuit and an authentication system that can prevent the manufacturing of a counterfeit product;

<figref idref="DRAWINGS">FIG. 2</figref> is a drawing illustrating an example of the configuration of the authentication system;

<figref idref="DRAWINGS">FIG. 3</figref> is a drawing illustrating an example of part of the configuration of the semiconductor integrated circuit;

<figref idref="DRAWINGS">FIG. 4</figref> is a drawing illustrating an example of a circuit that is obtained by incorporating PUF circuits into the circuit illustrated in <figref idref="DRAWINGS">FIG. 3</figref>;

<figref idref="DRAWINGS">FIG. 5</figref> is a drawing illustrating an example of the configuration of an HCI-SA-PUF circuit;

<figref idref="DRAWINGS">FIG. 6</figref> is a drawing for explaining a first function of a circuit obtained by combining a PUF circuit and an XOR gate;

<figref idref="DRAWINGS">FIG. 7</figref> is a drawing for explaining a second function of the circuit obtained by combining a PUF circuit and an XOR gate;

<figref idref="DRAWINGS">FIG. 8</figref> is a drawing for explaining a function of a circuit obtained by combining PUF circuits and a selector circuit;

<figref idref="DRAWINGS">FIG. 9</figref> is a drawing for explaining another function of the circuit obtained by combining PUF circuits and a selector circuit;

<figref idref="DRAWINGS">FIG. 10</figref> is a drawing for explaining yet another function of the circuit obtained by combining PUF circuits and a selector circuit;

<figref idref="DRAWINGS">FIG. 11</figref> is a drawing for explaining yet another function of the circuit obtained by combining PUF circuits and a selector circuit;

<figref idref="DRAWINGS">FIG. 12</figref> is a drawing for explaining yet another function of the circuit obtained by combining PUF circuits and a selector circuit;

<figref idref="DRAWINGS">FIG. 13</figref> is a drawing for explaining yet another function of the circuit obtained by combining PUF circuits and a selector circuit;

<figref idref="DRAWINGS">FIG. 14</figref> is a drawing illustrating another example of the configuration of the semiconductor integrated circuit;

<figref idref="DRAWINGS">FIG. 15</figref> is a drawing illustrating yet another example of the configuration of the semiconductor integrated circuit;

<figref idref="DRAWINGS">FIG. 16</figref> is a drawing illustrating an example of the configuration of a function circuit; and

<figref idref="DRAWINGS">FIG. 17</figref> is a drawing illustrating an example of a circuit that is obtained by incorporating PUF circuits into the circuit illustrated in <figref idref="DRAWINGS">FIG. 16</figref>.

DESCRIPTION OF EMBODIMENTS

In the following, embodiments of the invention will be described with reference to the accompanying drawings.

<figref idref="DRAWINGS">FIGS. 1A and 1B</figref> are drawings illustrating an example of the configuration of a semiconductor integrated circuit and an authentication system that can prevent the manufacturing of a counterfeit product. A semiconductor integrated circuit <b>10</b> illustrated in <figref idref="DRAWINGS">FIG. 1A</figref> generates an M-bit output in response to an N-bit input. N is an integer greater than or equal to 2, and M is an integer greater than or equal to 1. The relationship between the input and the output of the semiconductor integrated circuit <b>10</b> serves to enable the realization of a predetermined function. Namely, the predetermined function generates one or M output bits in response to N input bits. This predetermined function may enable the provision of the input-and-output relationship of a certain transformation function, for example.

The semiconductor integrated circuit <b>10</b> has at least one PUF circuit <b>11</b> embedded therein. More specifically, the PUF circuit <b>11</b> is embedded in the semiconductor integrated circuit <b>10</b> such that at least one node in the semiconductor integrated circuit <b>10</b> has a signal value varying in response to the output of the PUF circuit <b>11</b>. The output of the PUF circuit <b>11</b> is set such that the semiconductor integrated circuit <b>10</b> provides the above-noted predetermined function.

The PUF circuit <b>11</b> used in this configuration is supposed to have 100% reproducibility. An example of such a PUF is a HCI-SA-PUF. HCI-SA-PUF is an improvement of a SA-PUF (i.e., sense-amplifier-PUF). A sense amplifier is a circuit that is typically used to amplify voltage from a memory cell, and serves to check the magnitude relationship between two inputs A and B. In the case of B being smaller than A, the output assumes “0”, for example. In the case of B being greater than A, the output assumes “1”. When the two inputs A and B applied to the sense amplifier are practically equal to each other, the output of the sense amplifier is set to “0” or “1” in response to a minute difference in the threshold and the like between individual transistor devices. Such an output value is dependent on the device-to-device variation of transistor thresholds and the like, and, thus, is expected to have reproducibility and uniqueness.

In reality, however, the output of an SA-PUF tends to depend on the voltage level, temperature, and the like, resulting in reproducibility being not 100%. Further, there is a problem in that the designer cannot control the output value.

In the case of an HCI-SA-PUF, the utilization of hot carrier injection (HCI) at the time of implementing a sense amplifier in an LSI chip makes it possible to raise the threshold voltage of a transistor device, thereby controlling the output value of the sense amplifier. Namely, the physical characteristics of the circuit can be controlled by use of HCI such that the output of the sense amplifier is set equal to either “0” or “1”. Further, the utilization of HCI enables a sufficient difference in the threshold value to occur between transistor devices, thereby making it possible to provide 100% reproducibility.

In <figref idref="DRAWINGS">FIG. 1A</figref>, the PUF circuit <b>11</b> may include a transistor device whose threshold value is set by hot carrier injection, thereby achieving 100% reproducibility. To be more specific, the PUF circuit <b>11</b> may be an HCI-SA-PUF.

The transformation from a plurality of inputs into one or more outputs that is implemented by the semiconductor integrated circuit <b>10</b> may be defined by a predetermined algorithm. The output of the PUF circuit <b>11</b> may be set such that this predetermined algorithm is realized. The transformation from a plurality of inputs into one or more outputs that is implemented by the semiconductor integrated circuit <b>10</b> may be an encryption function. The output of the PUF circuit <b>11</b> may be set such that this encryption function is realized. In the case of the semiconductor integrated circuit <b>10</b> being an authentication circuit embedded in a device to be authenticated by an authentication system, the server of the authentication system may have the above-noted predetermined algorithm or encryption function stored therein. Namely, in an authentication server <b>12</b> illustrated in <figref idref="DRAWINGS">FIG. 1B</figref>, a transformation function <b>13</b> that enables the provision of the predetermined algorithm or encryption function may be stored in a memory device such as a hard disk drive.

In order to check whether a device in question is a genuine product, the authentication server <b>12</b> supplies a challenge as an input into the semiconductor integrated circuit <b>10</b> of the device in question, and receives the response generated by the semiconductor integrated circuit <b>10</b>. The authentication server <b>12</b> checks whether the received response is in agreement with an output that is internally generated by inputting the same value as the above-noted challenge into the internal transformation function <b>13</b>. In the case of the response being in agreement with the internally generated output, the authentication result indicates that the device in question is a genuine product. In the case of the response being not in agreement with the internally generated output, the device in question is rejected as being not a genuine product. The transformation function of the semiconductor integrated circuit <b>10</b> may not be an encryption function per se, but may be a nonlinear transformation circuit for encryption.

In the semiconductor integrated circuit and the authentication system illustrated in <figref idref="DRAWINGS">FIGS. 1A and 1B</figref> as described above, the authentication server <b>12</b> has only the transformation function <b>13</b> stored therein. The authentication system illustrated in <figref idref="DRAWINGS">FIGS. 1A and 1B</figref> thus offers a high degree of convenience as compared with the related-art configuration in which the authentication server has a large size table stored therein. Further, the authentication system illustrated in <figref idref="DRAWINGS">FIGS. 1A and 1B</figref> also offers a high degree of convenience as compared with the related-art configuration in which the authentication server has an encryption function and device-specific keys stored therein. Moreover, the authentication system illustrated in <figref idref="DRAWINGS">FIGS. 1A and 1B</figref> has a PUF embedded in the semiconductor integrated circuit, which offers a high level of anti-counterfeiting security as compared with the related-art configuration in which correction data and keys are stored in a nonvolatile memory or register. Namely, the authentication system illustrated in <figref idref="DRAWINGS">FIGS. 1A and 1B</figref> do not have a weak point as in the related-art configurations.

<figref idref="DRAWINGS">FIG. 2</figref> is a drawing illustrating an example of the configuration of an authentication system. A device <b>15</b> to be authenticated is capable of communicating with the authentication server <b>12</b> through radio or the like. The device <b>15</b> includes an authentication circuit <b>10</b> corresponding to the semiconductor integrated circuit <b>10</b> illustrated in <figref idref="DRAWINGS">FIGS. 1A and 1B</figref>, and also includes a function circuit <b>16</b>. The function circuit <b>16</b> serves to provide the functionality that is the main reason for a user to use the device <b>15</b>. In the case of the device <b>15</b> being a portable phone, for example, the function circuit <b>16</b> serves to provide portable phone functionality.

The authentication server <b>12</b> gives a challenge to the semiconductor integrated circuit <b>10</b> to receive a response as previously described, thereby checking the genuineness of the device <b>15</b> having the authentication circuit <b>10</b> embedded therein. In the case of the device <b>15</b> being found to be a genuine product as a result of authentication, the function circuit <b>16</b> of the device <b>15</b> is allowed to perform a desired operation based upon permission given from the authentication server <b>12</b>. In the case of the device <b>15</b> being found to be not a genuine product as a result of authentication, the function circuit <b>16</b> of the device <b>15</b> is not allowed to perform a desired operation upon being rejected by the authentication server <b>12</b>.

It may be noted that a PUF circuit may be incorporated into the function circuit <b>16</b> to improve anti-counterfeiting security. Namely, the PUF circuit <b>16</b> may be embedded in the function circuit <b>16</b> such that at least one node in the function circuit <b>16</b> has a signal value varying in response to the output of the PUF circuit. The output of the PUF circuit may then be set such that the function circuit <b>16</b> provides the above-noted predetermined functionality.

<figref idref="DRAWINGS">FIG. 3</figref> is a drawing illustrating an example of part of the configuration of the semiconductor integrated circuit <b>10</b>. The circuit illustrated in <figref idref="DRAWINGS">FIG. 3</figref> is designed to output the second bit of nonlinear transformation function S7 in KASUMI encryption. In the case of the transformation function of the semiconductor integrated circuit <b>10</b> being a KASUMI encryption function, the circuit illustrated in <figref idref="DRAWINGS">FIG. 3</figref> constitutes a portion of the semiconductor integrated circuit <b>10</b>.

The use of the publicly known transformation function such as S7 may be associated with a risk of the transformation function being identified to be S7 by reverse engineering, which leads to the consequence that the malignant user successfully learns the algorithm of the transformation function. In consideration of this, it is preferable for the transformation function used in the semiconductor integrated circuit <b>10</b> to be an encryption function or the like that is independently developed and that is thus not publicly known. For the sake of convenience, however, publicly known S7 will be used as an example in the following.

Nonlinear transformation function S7 illustrated in <figref idref="DRAWINGS">FIG. 3</figref> outputs one bit y₂in response to 7 input bits X₀through X₆. The nonlinear transformation circuit for implementing this function includes inverters <b>20</b> and <b>21</b>, AND gates <b>22</b> through <b>29</b>, OR gates <b>30</b> through <b>34</b>, and a constant inputting circuit <b>35</b> as illustrated in <figref idref="DRAWINGS">FIG. 3</figref>. As will be described in the following, a PUF circuit may be embedded in the nonlinear transformation circuit such that at least one node in the nonlinear transformation circuit has a signal value varying in response to the output of the PUF circuit. In such a configuration, the output of the PUF circuit is set such that the nonlinear transformation circuit provides the predetermined functionality (i.e., the functionality that enables the realization of the input-and-output relationship of transformation function S7).

<figref idref="DRAWINGS">FIG. 4</figref> is a drawing illustrating an example of a circuit that is obtained by incorporating PUF circuits into the circuit illustrated in <figref idref="DRAWINGS">FIG. 3</figref>. In <figref idref="DRAWINGS">FIG. 4</figref>, the same or corresponding elements as those of <figref idref="DRAWINGS">FIG. 3</figref> are referred to by the same or corresponding numerals, and a description thereof will be omitted as appropriate.

In the circuit illustrated in <figref idref="DRAWINGS">FIG. 4</figref>, the inverter of <figref idref="DRAWINGS">FIG. 3</figref> is replaced with a PUF circuit <b>20</b>A and an XOR gate <b>20</b>B, and the inverter <b>21</b> is replaced with a PUF circuit <b>21</b>A and an XOR gate <b>21</b>B. Further, the AND gate <b>26</b> is replaced with PUF circuits <b>26</b>A-<b>1</b> through <b>26</b>A-<b>4</b> and a selector circuit <b>26</b>B. PUF circuits <b>36</b>A through <b>38</b>A and XOR gates <b>36</b>B through <b>38</b>B are also added and placed in interconnection lines. Moreover, the constant inputting circuit <b>35</b> is replaced with a PUF circuit <b>35</b>A. In the example of the circuit illustrated in <figref idref="DRAWINGS">FIG. 4</figref>, each PUF circuit is an HCI-SA-PUF circuit.

<figref idref="DRAWINGS">FIG. 5</figref> is a drawing illustrating an example of the configuration of an HCI-SA-PUF circuit. The HCI-SA-PUF circuit illustrated in <figref idref="DRAWINGS">FIG. 5</figref> includes PMOS transistors <b>41</b> and <b>42</b>, NMOS transistors <b>43</b> through <b>47</b>, and offset creating circuits <b>48</b> and <b>49</b>. The circuit portion constituted by PMOS transistors <b>41</b> and <b>42</b> and NMOS transistors <b>43</b> through <b>47</b> corresponds to a sense amplifier circuit. In the sense amplifier circuit, applying input voltages IN<b>1</b> and IN<b>2</b>, which are equal to each other, to the gates of the NMOS transistors <b>45</b> and <b>46</b>, respectively, causes different amounts of currents responsive to the respective threshold voltages to flow through the NMOS transistors <b>45</b> and <b>46</b>. The difference in the amount of current is amplified by the latch function of the circuit portion constituted by the PMOS transistors <b>41</b> and <b>42</b> and the NMOS transistors <b>43</b> and <b>44</b>, resulting in output voltages OUT<b>1</b> and OUT<b>2</b> being produced.

The threshold level of the NMOS transistor <b>45</b> may be set higher through hot carrier injection than the threshold level of the NMOS transistor <b>46</b>, for example. In such a case, the output voltages OUT<b>1</b> and OUT<b>2</b> are set to HIGH and LOW, respectively. Conversely, the threshold level of the NMOS transistor <b>46</b> may be set higher through hot carrier injection than the threshold level of the NMOS transistor <b>45</b>. In such a case, the output voltages OUT<b>1</b> and OUT<b>2</b> are set to LOW and HIGH, respectively.

Hot carrier injection into the NMOS transistor <b>45</b> or <b>46</b> is performed by use of the offset creating circuits <b>48</b> and <b>49</b>. Specifically, the offset creating circuits <b>48</b> and <b>49</b> set the drain voltage, the source voltage and the gate voltage of the NMOS transistor <b>45</b> to respective, proper voltage levels such that hot carriers are injected into the gate insulating layer of the NMOS transistor <b>45</b>. Alternatively, the offset creating circuits <b>48</b> and <b>49</b> set the drain voltage, the source voltage and the gate voltage of the NMOS transistor <b>46</b> to respective, proper voltage levels such that hot carriers are injected into the gate insulating layer of the NMOS transistor <b>46</b>. In general, hot carrier injection occurs in a prominent manner when high voltage is applied to the drain with the gate voltage being smaller than the drain voltage. Especially when the gate voltage is approximately half the drain voltage, hot carrier injection occurs with the maximum intensity.

In this manner, hot carriers are intentionally injected into the gate insulating layer of one of the NMOS transistors <b>45</b> and <b>46</b>, thereby raising the threshold voltage of the transistor. Namely, a difference in threshold voltage is generated between the NMOS transistor <b>45</b> and the NMOS transistor <b>46</b>. Since the output value of the HCI-SA-PUF circuit is responsive to such a difference in threshold voltage, the threshold voltage adjustment as described above enables the output value of the HCI-SA-PUF circuit to be set to a desired value.

<figref idref="DRAWINGS">FIG. 6</figref> is a drawing for explaining a first function of a circuit obtained by combining a PUF circuit and an XOR gate. In <figref idref="DRAWINGS">FIG. 6</figref>, the output of an HCI-SA-PUF circuit <b>50</b>A is supplied to one input of an XOR gate <b>50</b>B. Further, an input signal IN from an input node is supplied to the other input of the XOR gate <b>50</b>B. With this configuration, a circuit is provided that outputs an output signal OUT that is the inverse of the input signal IN. The circuit illustrated in <figref idref="DRAWINGS">FIG. 6</figref> may be used in place of the inverters <b>20</b> and <b>21</b> contained in the circuit illustrated in <figref idref="DRAWINGS">FIG. 3</figref>. Analysis by use of a microscope cannot identify the output value of an HCI-SA-PUF circuit. It is thus impossible to determine through external inspection whether or not the circuit portion constituted by the HCI-SA-PUF circuit <b>20</b>A and the XOR gate <b>20</b>B illustrated in <figref idref="DRAWINGS">FIG. 4</figref> is an inverter.

<figref idref="DRAWINGS">FIG. 7</figref> is a drawing for explaining a second function of the circuit obtained by combining a PUF circuit and an XOR gate. In <figref idref="DRAWINGS">FIG. 7</figref>, the output of an HCI-SA-PUF circuit <b>51</b>A is supplied to one input of an XOR gate <b>51</b>B. Further, an input signal IN from an input node is supplied to the other input of the XOR gate <b>51</b>B. With this configuration, a circuit is provided that outputs an output signal OUT that is the same as the input signal IN. The circuit illustrated in <figref idref="DRAWINGS">FIG. 7</figref> may be placed in the interconnection line connected to the output of the AND gate <b>26</b> contained in the circuit illustrated in <figref idref="DRAWINGS">FIG. 3</figref>. Analysis by use of a microscope cannot identify the output value of an HCI-SA-PUF circuit. It is thus impossible to determine through external inspection whether or not the circuit portion constituted by the HCI-SA-PUF circuits <b>36</b>A and <b>37</b>A and the XOR gates <b>36</b>B and <b>37</b>B illustrated in <figref idref="DRAWINGS">FIG. 4</figref> is equivalent to an interconnection line through which no signal alteration occurs.

<figref idref="DRAWINGS">FIG. 8</figref> is a drawing for explaining a function of a circuit obtained by combining PUF circuits and a selector circuit. In <figref idref="DRAWINGS">FIG. 8</figref>, the outputs of HCI-SA-PUF circuits <b>61</b>A-<b>1</b> through <b>61</b>A-<b>4</b> are supplied as inputs to a selector circuit <b>61</b>B. The selector circuit <b>61</b>B further receives, as selection control signals, signals A and B each of which is a one-bit signal. The outputs of the HCI-SA-PUF circuits <b>61</b>A-<b>1</b>, <b>61</b>A-<b>2</b>, <b>61</b>A-<b>3</b>, and <b>61</b>A-<b>4</b> are 0, 0, 0, and 1, respectively.

In the case of the selection control signals A and B being both “0”, the selector circuit <b>61</b>B selects the “0” output of the HCI-SA-PUF circuit <b>61</b>A-<b>1</b> to output “0”. In the case of the selection control signals A and B being “0” and “1”, respectively, the selector circuit <b>61</b>B selects the “0” output of the HCI-SA-PUF circuit <b>61</b>A-<b>2</b> to output “0”. In the case of the selection control signals A and B being “1” and “0”, respectively, the selector circuit <b>61</b>B selects the “0” output of the HCI-SA-PUF circuit <b>61</b>A-<b>3</b> to output “0”. In the case of the selection control signals A and B being both “1”, the selector circuit <b>61</b>B selects the “1” output of the HCI-SA-PUF circuit <b>61</b>A-<b>4</b> to output “1”.

The circuit illustrated in <figref idref="DRAWINGS">FIG. 8</figref> performs an AND operation as described above. It follows that the AND gate <b>26</b> contained in the circuit illustrated in <figref idref="DRAWINGS">FIG. 3</figref> can be replaced with the circuit illustrated in <figref idref="DRAWINGS">FIG. 8</figref>. Analysis by use of a microscope cannot identify the output value of an HCI-SA-PUF circuit. It is thus impossible to determine through external inspection whether or not the circuit portion constituted by the HCI-SA-PUF circuits <b>26</b>A-<b>1</b> through <b>26</b>A-<b>4</b> and the selector circuit <b>26</b>B illustrated in <figref idref="DRAWINGS">FIG. 4</figref> is an AND gate.

<figref idref="DRAWINGS">FIG. 9</figref> is a drawing for explaining another function of the circuit obtained by combining PUF circuits and a selector circuit. In <figref idref="DRAWINGS">FIG. 9</figref>, the outputs of HCI-SA-PUF circuits <b>62</b>A-<b>1</b> through <b>62</b>A-<b>4</b> are supplied as inputs to a selector circuit <b>62</b>B. Further, selection control signals A and B each of which is a one-bit signal are used to determine which one of the outputs of the HCI-SA-PUF circuits is selected by the selector circuit <b>62</b>B. The outputs of the HCI-SA-PUF circuits <b>62</b>A-<b>1</b>, <b>62</b>A-<b>2</b>, <b>62</b>A-<b>3</b>, and <b>62</b>A-<b>4</b> are 0, 1, 1, and 1, respectively. The circuit illustrated in <figref idref="DRAWINGS">FIG. 9</figref> thus performs an OR operation. One or more OR gates contained in the circuit illustrated in <figref idref="DRAWINGS">FIG. 3</figref> may be replaced with the circuit illustrated in <figref idref="DRAWINGS">FIG. 9</figref>.

<figref idref="DRAWINGS">FIG. 10</figref> is a drawing for explaining yet another function of the circuit obtained by combining PUF circuits and a selector circuit. In <figref idref="DRAWINGS">FIG. 10</figref>, the outputs of HCI-SA-PUF circuits <b>63</b>A-<b>1</b> through <b>63</b>A-<b>4</b> are supplied as inputs to a selector circuit <b>63</b>B. Further, selection control signals A and B each of which is a one-bit signal are used to determine which one of the outputs of the HCI-SA-PUF circuits is selected by the selector circuit <b>63</b>B. The outputs of the HCI-SA-PUF circuits <b>63</b>A-<b>1</b>, <b>63</b>A-<b>2</b>, <b>63</b>A-<b>3</b>, and <b>63</b>A-<b>4</b> are 0, 1, 1, and 0, respectively. The circuit illustrated in <figref idref="DRAWINGS">FIG. 10</figref> thus performs an XOR operation. If an XOR gate is provided in the semiconductor integrated circuit <b>10</b> illustrated in <figref idref="DRAWINGS">FIG. 1</figref>, such an XOR gate may be replaced with the circuit illustrated in <figref idref="DRAWINGS">FIG. 10</figref>.

<figref idref="DRAWINGS">FIG. 11</figref> is a drawing for explaining yet another function of the circuit obtained by combining PUF circuits and a selector circuit. In <figref idref="DRAWINGS">FIG. 11</figref>, the outputs of HCI-SA-PUF circuits <b>64</b>A-<b>1</b> through <b>64</b>A-<b>4</b> are supplied as inputs to a selector circuit <b>64</b>B. Further, selection control signals A and B each of which is a one-bit signal are used to determine which one of the outputs of the HCI-SA-PUF circuits is selected by the selector circuit <b>64</b>B. The outputs of the HCI-SA-PUF circuits <b>64</b>A-<b>1</b>, <b>64</b>A-<b>2</b>, <b>64</b>A-<b>3</b>, and <b>64</b>A-<b>4</b> are 1, 1, 1, and 0, respectively. The circuit illustrated in <figref idref="DRAWINGS">FIG. 11</figref> thus performs an NAND operation. If a NAND gate is provided in the semiconductor integrated circuit <b>10</b> illustrated in <figref idref="DRAWINGS">FIG. 1</figref>, such a NAND gate may be replaced with the circuit illustrated in <figref idref="DRAWINGS">FIG. 11</figref>.

<figref idref="DRAWINGS">FIG. 12</figref> is a drawing for explaining yet another function of the circuit obtained by combining PUF circuits and a selector circuit. In <figref idref="DRAWINGS">FIG. 12</figref>, the outputs of HCI-SA-PUF circuits <b>65</b>A-<b>1</b> through <b>65</b>A-<b>4</b> are supplied as inputs to a selector circuit <b>65</b>B. Further, selection control signals A and B each of which is a one-bit signal are used to determine which one of the outputs of the HCI-SA-PUF circuits is selected by the selector circuit <b>65</b>B. The outputs of the HCI-SA-PUF circuits <b>65</b>A-<b>1</b>, <b>65</b>A-<b>2</b>, <b>65</b>A-<b>3</b>, and <b>65</b>A-<b>4</b> are 1, 0, 0, and 0, respectively. The circuit illustrated in <figref idref="DRAWINGS">FIG. 12</figref> thus performs a NOR operation. If a NOR gate is provided in the semiconductor integrated circuit <b>10</b> illustrated in <figref idref="DRAWINGS">FIG. 1</figref>, such a NOR gate may be replaced with the circuit illustrated in <figref idref="DRAWINGS">FIG. 12</figref>.

<figref idref="DRAWINGS">FIG. 13</figref> is a drawing for explaining yet another function of the circuit obtained by combining PUF circuits and a selector circuit. In <figref idref="DRAWINGS">FIG. 13</figref>, the outputs of HCI-SA-PUF circuits <b>66</b>A-<b>1</b> through <b>66</b>A-<b>4</b> are supplied as inputs to a selector circuit <b>66</b>B. Further, selection control signals A and B each of which is a one-bit signal are used to determine which one of the outputs of the HCI-SA-PUF circuits is selected by the selector circuit <b>66</b>B. The outputs of the HCI-SA-PUF circuits <b>66</b>A-<b>1</b>, <b>66</b>A-<b>2</b>, <b>66</b>A-<b>3</b>, and <b>66</b>A-<b>4</b> are 1, 0, 0, and 1, respectively. The circuit illustrated in <figref idref="DRAWINGS">FIG. 13</figref> thus performs an NXOR operation. If an NXOR gate is provided in the semiconductor integrated circuit <b>10</b> illustrated in <figref idref="DRAWINGS">FIG. 1</figref>, such an NXOR gate may be replaced with the circuit illustrated in <figref idref="DRAWINGS">FIG. 13</figref>.

<figref idref="DRAWINGS">FIG. 14</figref> is a drawing illustrating another example of the configuration of the semiconductor integrated circuit <b>10</b>. In the example illustrated in <figref idref="DRAWINGS">FIG. 14</figref>, the circuit configuration that uses the selector circuit to select one of the outputs of PUF circuits enables the realization of the transformation function of the semiconductor integrated circuit <b>10</b> that has an N-bit input and an M-bit output.

The circuit illustrated in <figref idref="DRAWINGS">FIG. 14</figref> includes 2^NM-bit-constant circuits <b>72</b>A-<b>1</b> through <b>72</b>A-<b>2</b>^Nand a selector circuit (multiplexer: MUX) <b>72</b>B. The selector circuit <b>72</b>B selects one of the 2^NM-bit-constant circuits <b>72</b>A-<b>1</b> through <b>72</b>A-<b>2</b>^Nin response to the values of N-bit selection control signals, thereby selectively outputting the M-bit output of the selected circuit. The outputs of the M-bit-constant circuits <b>72</b>A-<b>1</b> through <b>72</b>A-<b>2</b>^Nare set to desired values, so that the circuit illustrated in <figref idref="DRAWINGS">FIG. 14</figref> enables the realization of any given transformation function having an N-bit input and an M-bit output. Each of the M-bit-constant circuits <b>72</b>A-<b>1</b> through <b>72</b>A-<b>2</b>^Nmay use M HCI-SA-PUF circuits to generate M constant output bits.

<figref idref="DRAWINGS">FIG. 15</figref> is a drawing illustrating yet another example of the configuration of the semiconductor integrated circuit <b>10</b>. A circuit <b>81</b> illustrated in <figref idref="DRAWINGS">FIG. 15</figref> includes a function circuit <b>82</b> having an N-bit input and an M-bit output, an N-bit-constant circuit <b>83</b>A, an XOR circuit <b>83</b>B, an M-bit-constant circuit <b>84</b>A, and an XOR circuit <b>84</b>B. The N-bit-constant circuit <b>83</b>A and the M-bit-constant circuit <b>84</b>A may use N HCI-SA-PUF circuits and M HCI-SA-PUF circuits to generate N constant output bits and M constant output bits, respectively.

As illustrated in the semiconductor integrated circuit of <figref idref="DRAWINGS">FIG. 15</figref>, the function circuit <b>82</b> having an N-bit input and an M-bit output may have an input thereof or an output thereof at least one of which is attached to an XOR gate that performs an XOR operation by use of the outputs of HCI-SA-PUF circuits. This circuit configuration enables the provision of a predetermined function having an N-bit input and an M-bit output. The predetermined function as noted above is not the transformation function realized by the input-and-output relationship of the function circuit <b>82</b>, but is the input-and-output relationship realized by the entirety of the circuit <b>81</b> in which at least one of the input and the output of the function circuit <b>82</b> is converted by an XOR gate.

The HCI-SA-PUF circuit <b>38</b>A and the XOR gate <b>38</b>B illustrated in <figref idref="DRAWINGS">FIG. 4</figref> serve to make an alteration by use of an XOR circuit at the output of the function circuit as in the case illustrated in <figref idref="DRAWINGS">FIG. 15</figref>. The constant output of the HCI-SA-PUF circuit <b>38</b>A is “1”. An inverse /y₂of the output y₂of the circuit illustrated in <figref idref="DRAWINGS">FIG. 3</figref> is thus obtained as the output of the circuit illustrated in <figref idref="DRAWINGS">FIG. 4</figref>. This output y₂is such an output that realizes the intended, desired function. If y₂, rather than /y₂, is the output that realizes the intended, desired function, the constant output of the PUF circuit <b>38</b>A is set equal to “0” rather than to “1”.

<figref idref="DRAWINGS">FIG. 3</figref> illustrates the example in which nonlinear transformation function S7 of KASUMI encryption is used with PUF circuits incorporated thereinto as an example of the configuration of an authentication circuit realized by the semiconductor integrated circuit <b>10</b>. As was previously described, a PUF circuit may be incorporated into the function circuit <b>16</b> rather than to an authentication circuit for the purpose of improving anti-counterfeiting security.

<figref idref="DRAWINGS">FIG. 16</figref> is a drawing illustrating an example of the configuration of the function circuit <b>16</b>. The circuit illustrated in <figref idref="DRAWINGS">FIG. 16</figref> is a full adder circuit, and includes inverters <b>90</b> and <b>91</b>, AND gates <b>92</b> through <b>95</b>, OR gates <b>96</b> and <b>97</b>, and NOR gates <b>98</b> and <b>99</b>. The full adder circuit adds up an input A, an input B, and a carry Ci to generate a sum S and a carry C.

<figref idref="DRAWINGS">FIG. 17</figref> is a drawing illustrating an example of a circuit that is obtained by incorporating PUF circuits into the circuit illustrated in <figref idref="DRAWINGS">FIG. 16</figref>. In <figref idref="DRAWINGS">FIG. 17</figref>, the same or corresponding elements as those of <figref idref="DRAWINGS">FIG. 16</figref> are referred to by the same or corresponding numerals, and a description thereof will be omitted as appropriate.

In the circuit illustrated in <figref idref="DRAWINGS">FIG. 17</figref>, the inverter <b>90</b> illustrated in <figref idref="DRAWINGS">FIG. 16</figref> is replaced with a PUF circuit <b>90</b>A and an XOR gate <b>90</b>B. Further, the NOR gate <b>99</b> is replaced with PUF circuits <b>99</b>A-<b>1</b> through <b>99</b>A-<b>4</b> and a selector circuit <b>99</b>B. Moreover, a PUF circuit <b>100</b>A and an XOR gate <b>100</b>B are placed in an interconnection line. In <figref idref="DRAWINGS">FIG. 17</figref>, each PUF circuit is an HCI-SA-PUF circuit. Analysis by use of a microscopy cannot identify the output value of an HCI-SA-PUF circuit. It is thus impossible to identify through external inspection what logic operations are performed by the PUF circuits incorporated into the configuration illustrated in <figref idref="DRAWINGS">FIG. 17</figref>. Further, fabricating a dead copy of the circuit structure on an LSI chip based on the analysis utilizing a microscopy ends up causing the logic to be changed, resulting in a failure to counterfeit the product. Accordingly, the full adder circuit that is a function circuit generated by incorporating PUF circuits as illustrated in <figref idref="DRAWINGS">FIG. 17</figref> is difficult to counterfeit.

In the example illustrated in <figref idref="DRAWINGS">FIG. 17</figref>, a one-bit full adder circuit has been used as an example of a function circuit for the sake of simplicity of explanation. Examples of functions realized by a function circuit include a video and audio processing function, a communication function, various interface functions, an arithmetic function, a data protection (encryption) function, etc. Further, there is no need for the function circuit to be provided on a device with an authentication circuit as illustrated in <figref idref="DRAWINGS">FIG. 2</figref>. The function circuit alone may be provided on a device without an authentication circuit.

Further, the present invention is not limited to these embodiments, but various variations and modifications may be made without departing from the scope of the present invention.

According to at least one embodiment, a semiconductor integrated circuit is provided that utilizes a PUF to effectively and efficiently prevent a counterfeit product from being manufactured, and, also, an authentication system and an authentication method that utilize such a semiconductor integrated circuit are provided.

All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the invention and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions, nor does the organization of such examples in the specification relate to a showing of the superiority and inferiority of the invention. Although the embodiment(s) of the present inventions have been described in detail, it should be understood that the various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the invention.